Self-Hosted Deployment

# Update system
sudo apt update && sudo apt upgrade -y

# Install Python 3.12
sudo add-apt-repository ppa:deadsnakes/ppa -y
sudo apt install python3.12 python3.12-venv python3.12-dev -y

# Install system dependencies
sudo apt install redis-server nginx git curl -y

# Create service user (never run OpenClaw as root)
sudo useradd --system --shell /bin/bash --home /opt/openclaw --create-home openclaw

# Switch to openclaw user
sudo -u openclaw -i

# As openclaw user: create venv and install
python3.12 -m venv /opt/openclaw/venv
source /opt/openclaw/venv/bin/activate
pip install --upgrade pip
pip install openclaw[redis,postgres]==1.5.2

# Verify installation
openclaw --version

# Create config directory
mkdir -p /opt/openclaw/config /opt/openclaw/data /opt/openclaw/logs

# Create config file (as root, then restrict permissions)
sudo tee /opt/openclaw/config/config.yaml <<'EOF'
openclaw_env: production
log_level: INFO
log_format: json
log_file: /opt/openclaw/logs/openclaw.log

llm:
  provider: openai
  model: gpt-4o-mini

cache:
  enabled: true
  backend: redis
  redis_url: "redis://127.0.0.1:6379/0"
  ttl: 3600

database:
  url: "sqlite:////opt/openclaw/data/openclaw.db"

server:
  host: 127.0.0.1    # Only listen on loopback; Nginx proxies externally
  port: 8080
  workers: 4

budget:
  max_cost_per_task: 0.50
  daily_token_limit: 500000
EOF

# Restrict config file permissions
sudo chmod 600 /opt/openclaw/config/config.yaml
sudo chown openclaw:openclaw /opt/openclaw/config/config.yaml

# Store API keys in /etc/environment or a .env file owned by openclaw
sudo tee /opt/openclaw/config/.env <<'EOF'
OPENAI_API_KEY=sk-your-key
OPENCLAW_SECRET_KEY=$(openssl rand -hex 32)
EOF
sudo chmod 600 /opt/openclaw/config/.env
sudo chown openclaw:openclaw /opt/openclaw/config/.env

# /etc/systemd/system/openclaw.service
[Unit]
Description=OpenClaw AI Agent Service
After=network.target redis.service
Requires=redis.service

[Service]
Type=exec
User=openclaw
Group=openclaw
WorkingDirectory=/opt/openclaw
EnvironmentFile=/opt/openclaw/config/.env
ExecStart=/opt/openclaw/venv/bin/openclaw serve   --config /opt/openclaw/config/config.yaml
Restart=on-failure
RestartSec=5
StandardOutput=journal
StandardError=journal

# Security hardening
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=strict
ReadWritePaths=/opt/openclaw/data /opt/openclaw/logs

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable openclaw
sudo systemctl start openclaw
sudo systemctl status openclaw

# /etc/nginx/sites-available/openclaw
server {
    listen 80;
    server_name api.yourcompany.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name api.yourcompany.com;

    ssl_certificate     /etc/letsencrypt/live/api.yourcompany.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/api.yourcompany.com/privkey.pem;

    # Rate limiting
    limit_req_zone $binary_remote_addr zone=openclaw:10m rate=30r/m;
    limit_req zone=openclaw burst=10 nodelay;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_read_timeout 120s;  # Allow long-running agent tasks
    }
}

# Install Certbot and get TLS certificate
sudo apt install certbot python3-certbot-nginx -y
sudo certbot --nginx -d api.yourcompany.com

# Enable the site and reload Nginx
sudo ln -s /etc/nginx/sites-available/openclaw /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx

# Stop service during update
sudo systemctl stop openclaw

# Activate venv and upgrade
sudo -u openclaw /opt/openclaw/venv/bin/pip install --upgrade openclaw

# Run any necessary db migrations
sudo -u openclaw /opt/openclaw/venv/bin/openclaw db migrate

# Restart
sudo systemctl start openclaw
sudo systemctl status openclaw